**Concrete quantum cryptanalysis of binary elliptic curves**

*Gustavo Banegas and Daniel J. Bernstein and Iggy van Hoof and Tanja Lange*

**Abstract: **This paper analyzes and optimizes quantum circuits for computing discrete logarithms
on binary elliptic curves, including reversible circuits
for fixed-base-point scalar multiplication and the full stack of relevant subroutines.
The main optimization target is the size of the quantum computer,
i.e., the number of logical qubits required, as this appears to be the main obstacle to implementing
Shor's polynomial-time discrete-logarithm algorithm. The secondary optimization target
is the number of logical Toffoli gates.

For an elliptic curve over a field of 2^n elements, this paper reduces the number of qubits to 7n+[log_2(n)]+9. At the same time this paper reduces the number of Toffoli gates to 48n^3+8n^(log_2(3)+1)+352n^2 log_2(n)+512n^2+O(n^(log_2(3))) with double-and-add scalar multiplication, and a logarithmic factor smaller with fixed-window scalar multiplication. The number of CNOT gates is also O(n^3). Exact gate counts are given for various sizes of elliptic curves currently used for cryptography.

**Category / Keywords: **implementation / Quantum cryptanalysis, elliptic curves, quantum resource estimation, quantum gates, Shor’s algorithm

**Original Publication**** (with major differences): **IACR-CHES-2021

**Date: **received 16 Oct 2020

**Contact author: **authorcontact-binecc at box cr yp to

**Available format(s): **PDF | BibTeX Citation

**Note: **This is the full version of the paper accepted to TCHES.

**Version: **20201019:073424 (All versions of this report)

**Short URL: **ia.cr/2020/1296

[ Cryptology ePrint archive ]